|
Most companies build their ACH, wire, and remote deposit capture controls around how fraud used to work, but fraud does not stay still. A dual approval process built for a straightforward wire request, or a check review built for a forged signature, can quietly stop protecting the company once fraudsters shift tactics, often unnoticed until a loss occurs. According to the 2026 Association for Financial Professionals (AFP) Payments Fraud and Control Survey, 76% of U.S. organizations experienced attempted or actual payments fraud in 2025.
Checks remained the most targeted method, cited by 58% of respondents, followed by ACH debits (30%) and wire transfers (25%). Business email compromise, where a fraudster impersonates an executive, vendor, or customer to redirect a payment, affected 74% of organizations in 2025, a sharp rise from prior years.
Business email compromise is dangerous because it exploits routine, not a technical weakness. A finance team that always wires funds after a familiar email, or a payroll clerk who updates direct deposit on request, is simply following a pattern fraudsters have learned to exploit. Security built around “the way we’ve always done it” is exactly what fraudsters count on. The same AFP survey found that 48% of organizations under $1 billion in revenue, and 66% above it, reported financial losses from payments fraud in 2025.
Strong security is not a one-time setup. Periodically ask whether your approval process, verification steps, and staff training still match how fraud is actually attempted today. An untested callback procedure, a dual control step that has become a single click, or an unstressed wire verification process are gaps that go unnoticed until exploited. Treat your controls as something worth testing regularly, not taking for granted.
|
